Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to run my nic on MacOSx at promiscuous mode and then use tshark / tcpdump

Option1:

 ifconfig en0 promisc

but I get this message:

ifconfig: promisc: bad value

Option 2:

I tried sudo tcpdump -In -i en0 host 10.0.0.2 and it didn't work too. I followed: tcpdump promiscuous mode on OSX 10.8 . 10.0.0.2 is my local host - and it prints nothing to bash:

tcpdump: listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes
^C
0 packets captured
99 packets received by filter
0 packets dropped by kernel
share|improve this question
add comment

1 Answer

TShark and tcpdump will put the interface into promiscuous mode unless you tell them NOT to do so with the -p flag - -p doesn't mean "promiscuous mode", it means "not promiscuous mode".

-I turns on monitor mode.

Note that if you're on a "protected" network using encryption, i.e. a network using WEP or WPA/WPA2, capture filters other than at the link layer won't work, because the packets being handed to the packet capture mechanism (BPF, in the case of OS X) do not have the payload decrypted. This means a filter such as "host 10.0.0.2" won't work.

share|improve this answer
    
what do you mean by BPF do not have the payload decrypted the key is identical to all the hosts in the network. –  0x90 Apr 30 '13 at 4:10
    
I mean that the OS will not decrypt the packets before handing it to the code that implements filters, even though it will decrypt packets sent to the host (but not packets sent to some other host) before handing them to the networking stack. Therefore, any filter expression that looks at the IP layer, such as "host 10.0.0.2", will fail. –  Guy Harris Apr 30 '13 at 7:11
    
So how can I sniff the packets ? –  0x90 Apr 30 '13 at 7:35
1  
If you're on a WEP or WPA/WPA2 network: don't use a capture filter, make sure you capture the initial EAPOL handshakes for all hosts you care about if it's a WPA/WPA2 network, and follow these directions in Wireshark (or manually add the keys to your Wireshark preferences file if you can only use TShark). –  Guy Harris Apr 30 '13 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.